Hi, it is possible for bots to make a POST request directly to the cart, but it should also be obvious the order was not paid and I expect there was other indicators that is was a fake order, such as IP - name, address, etc.
Do you happen to have "email" enabled as a payment option?